Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was talking earlier to a script kiddie and claimed that IP spoofing can increase the upload speed in a DDOS attack?! that does not make any sense to me According to him if your server has an upload speed of 1Gbps IP Spoofing will help you strike a target with a 10Gbps DDOS attack, any explanation? Thank you for your answers

share|improve this question
    
It really theoretically could, if those limits are based on SRCIP. Spoofing SRC you'd have limit*src band. Anyway, it seems quite an unreal situation to me, since a real DDOS involves multiple nets with multiple confs. –  user1293137 Jan 23 at 12:00
add comment

1 Answer

He is referring to an attack such as a DNS Amplification Attack. He is not increasing his upstream, but he would be increasing the amount of data being sent to the target.

To make it simple:

  • Your friend (1.2.3.4) wants to attack some server (6.7.8.9).
  • He spoofs his address to appear to come from the server (6.7.8.9).
  • He sends a DNS request to third party server consisting of ~60 bytes.
  • The DNS server responds back to the spoofed IP (6.7.8.9) with a ~4000 byte reply.

You can find more details on the details of DNS amplification attacks here.

There are other services that are vulnerable to these types of attack too, including NTP. It also might be worth noting that in my experience, it is very rare that you will find a residential ISP that will forward spoofed packets.

share|improve this answer
1  
DNS, NTP, SNMP, etc. are all potential vectors for amplification. –  Polynomial Jan 23 at 15:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.